Research map / Adversarial robustness and security / Attacks on text and graphs

ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio–Language Models

NeurIPS 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Adversarial prompts for language models · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes ALMGuard, an inference-time defense for audio-language models that adds a universal Shortcut Activation Perturbation restricted by a Mel-Gradient Sparse Mask to defend against ALM-specific jailbreaks while preserving benign utility.

Problem

Audio-language models are vulnerable to ALM-specific jailbreak attacks, and defenses transferred from audio adversarial attacks or text LLM jailbreaks are largely ineffective; the paper targets defending ALMs without hurting benign speech performance.

Approach

Assume ALMs contain latent safety-aligned shortcuts that a universal acoustic perturbation (SAP) can activate; restrict the perturbation to Mel-frequency bins with high jailbreak-mitigation gradient sensitivity and low ASR gradient sensitivity (M-GSM), optimized with PGD toward a fixed refusal target.

Key results

• ALMGuard reduces average SRoA across four ALMs and six attacks from 41.6% (no defense) to 14.6%, and to 4.6% on AdvWave averaged across models.
• On Qwen2-Audio, WER rises only from 6.85% to 8.70% with ALMGuard, versus 26.85% without M-GSM.
• Under adaptive white-box AdvWave attacks on LLaMA-Omni, ALMGuard keeps SRoA low while all baselines exceed 70% SRoA.

Measured effects reported in the paper

Surprising findings

• Traditional audio defenses such as local smoothing increased SRoA under adaptive attacks, likely because the transformations act as data augmentation strengthening the adversarial suffix.
• Using an ASR loss to guide the perturbation did not help utility preservation; the Mel-gradient mask was the key factor.

Limitations

• Weaker than the best baselines against some semantic-based attacks such as PAIR-Audio.
• Requires choosing k per model; Qwen2.5-Omni needed k=128 to defend semantic attacks, which hurts utility somewhat.
• Evaluated only on acoustic and semantic attacks available at publication; adaptive attacks limited to AdvWave on LLaMA-Omni.

Experimental setup

Datasets: AdvBench AdvBench-Audio LibriSpeech AIR-Bench-Chat

Benchmarks: AdvBench-Audio LibriSpeech AIR-Bench-Chat

Metrics: Success Rate of Attack (SRoA) Word Error Rate (WER) Response Quality Score (RQS)

Baselines: Gaussian Noise Local Smoothing Downsampling Self-Reminder In-Context Defense

Builds on: AdvWave Projected Gradient Descent Whisper

Closest papers by meaning

• JALMBench: Benchmarking Jailbreak Vulnerabilities in Audio Language Models (ICLR 2026 · similarity 0.93)
• Jailbreak-AudioBench: In-Depth Evaluation and Analysis of Jailbreak Threats for Large Audio Language Models (NeurIPS 2025 · similarity 0.91)
• MMJ-Bench: A Comprehensive Study on Jailbreak Attacks and Defenses for Vision Language Models (AAAI 2025 · similarity 0.88)
• AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Models (ICLR 2025 · similarity 0.87)
• The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense (NeurIPS 2025 · similarity 0.87)
• Safety Alignment Should be Made More Than Just a Few Tokens Deep (ICLR 2025 · similarity 0.86)